Privacy Policy for Euphile Platform
Introduction
This Privacy Policy explains how revzper SAS processes your personal data in compliance with applicable data protection regulations.
1. Purpose of the Policy
This policy applies to all products under the Euphile platform operated by revzper SAS.
Data Controller and Data Protection Contact
1. Identity of the Data Controller
The data controller is revzper SAS, SIREN 945 219 186, with registered office at 60 rue François Ier, 75008 Paris, France.
2. Data Protection Contact
revzper SAS has designated a data protection contact to handle inquiries and requests related to this policy and data protection matters. Contact: privacy@revzper.com.
3. Scope of Products
All products under the Euphile platform are operated by revzper SAS. For product-specific inquiries, contact the data protection contact.
Purposes and Legal Bases for Processing
1. Service Provision and Maintenance
Processing is necessary for providing and maintaining services, including account management and customer support.
Ref: GDPR Art. 6(1)(b)
2. Marketing and Service Communications
Processing for marketing communications requires consent. Service-related communications rely on legitimate interests. Opt-out mechanisms are provided for both categories.
Ref: GDPR Art. 6(1)(a), GDPR Art. 6(1)(f)
3. Service Improvement
Processing for analytics and user feedback relies on legitimate interests with an option to opt-out.
Ref: GDPR Art. 6(1)(f)
4. Training Datasets, With Your Consent
revzper SAS does not use your content to train or fine-tune AI models. The one exception is feedback you send through an application, where it offers this, when you also tick the separate box that asks whether this feedback may be used to train and evaluate the platform's AI models. The box is unticked every time you send feedback and is never ticked for you; leaving it unticked changes nothing in how your feedback is handled or in the service you receive. By ticking it, you agree that revzper SAS: removes from the feedback and the context you attached the secrets and the data identifying a person before it joins the dataset, the application showing you what would remain before you send it; uses the result only to test, train and fine-tune the AI models that serve the platform's features for all users, never a model built for another customer, and never sells or publishes it; may have that training carried out on its behalf by an AI provider in the European Union acting as its processor, under a contract that forbids the provider to use the dataset for itself; and keeps it in the dataset for at most one year from when you sent it, then deletes it. The dataset keeps a reference to your feedback so that it can be removed if you withdraw. That use rests on your consent, given for that feedback. You can withdraw it at any time by contacting the data protection contact: the feedback is then removed from the dataset and left out of any later training; the withdrawal does not affect the lawfulness of the use made before it, and a model already trained with the feedback is not retrained.
Ref: GDPR Art. 6(1)(a), GDPR Art. 7(3)
5. Legal Compliance
Processing is necessary to comply with legal obligations such as tax reporting and fraud prevention.
Ref: GDPR Art. 6(1)(c)
6. Disputes and Mediation
When a dispute with a user cannot be resolved directly, revzper SAS processes the data needed to establish, exercise or defend its rights, on the basis of its legitimate interest. For this purpose it may transmit those data to the consumer mediator the user refers the dispute to, MEDIATION SOLUTION, 222 chemin de la Bergerie, 01800 Saint-Jean-de-Niost, France (https://www.sasmediationsolution-conso.fr), to the competent courts and to its legal advisers. Each of them processes the data as a separate controller, for the purpose of resolving the dispute.
Ref: GDPR Art. 6(1)(f), GDPR Art. 13
Categories of Personal Data Processed
1. Identifying Data
Name, email address, phone number, postal address, and account credentials.
2. Technical Data
IP address, device identifiers, browser type, operating system, and cookies.
3. Usage Data
Interaction with services, transaction history, and support requests.
4. Financial Data
Payment details processed by third-party service providers.
5. Communication Data
Content of emails, chat messages, or other communications with support team.
6. Repository Content Submitted to Nassau for Analysis
Repository content you ask Nassau to analyse. When you run an AI analysis of a scan finding, Nassau sends the flagged file and facts about it collected on your computer to the AI model that serves the analysis: paths of files in the repository, commit subjects, dates and counts, configuration lines, the names (not the values) of the environment variables the file reads, and up to three further excerpts or searches of the repository the AI asks for. When the AI's first answer is not settled, it may ask, over up to four further rounds, for more excerpts, listings and searches of the repository, details of commits and installed packages, which programs are listening on network ports of your computer, and which running programs have a word it names in their command line; for a program, only its name, process number and start time are sent, never its command line. Environment, key and credential files, author names and email addresses, your user profile path and environment variable values are not sent. You can turn the facts, searches and checks off in Nassau's Settings. The content goes to the model you choose: one the platform provides, where your account includes it; an AI provider you configure with your own account; or, where Nassau offers it, a model that runs on your own computer, in which case the content does not leave your computer. If you choose a provider or model other than those the platform provides, you are responsible for that choice and for how that provider or model processes the content, whatever your role in Nassau, including creator or administrator.
Ref: GDPR Art. 13(1)(e), GDPR Art. 14(1)(d)
7. What Nassau Keeps on Your Computer, and What It Reports
Nassau's call journal keeps on your computer a record of each AI call made through Nassau and of each request Nassau sent from your computer: when, to which service, for what purpose, its size and its result, without its content. You choose how many days it is kept, from 7 to 365, 30 unless you change it, and older days are deleted. What an AI call sent and received is kept only if you turn that on, which is off by default; it is then encrypted with a key that only your Windows account can open, through Nassau, and it is deleted with the rest of that day's record. These records stay on your computer: revzper SAS does not receive them. If your role in Nassau is creator or administrator, Nassau also reports to the platform each call that a model on your computer answered, by its time, the model, the number of tokens, its result and the program that made it, never what was asked or answered, so that the platform's usage records are complete; you can turn that report off in Nassau's AI Settings, and for other roles these calls are not reported. When Nassau downloads a model to your computer, the hosting service it comes from receives your computer's address, as for any download.
8. Feedback You Send
Where an application offers it, the feedback you choose to send: whether something worked or did not, your comment, and the context you decide to attach, such as the request you made, the answer you received or the error shown. revzper SAS studies it to understand and fix problems and to improve the platform, as part of Service Improvement. It is used to train or evaluate AI models only if you also tick, for that feedback, the separate box described in "Training Datasets, With Your Consent", and then only after the secrets and the data identifying a person have been removed from it.
9. Third-Party Data Processors
1. Comprehensive Processor List
revzper SAS engages four third-party processors: Scaleway SAS (Paris, France), which hosts the platform and its data in France; Mollie B.V. (Amsterdam, Netherlands), which processes subscription payments as an independent controller under its own terms; Microsoft Ireland Operations Limited (Dublin, Ireland), which serves OpenAI models through Microsoft Foundry on European Union data zone deployments from a resource in France; and Mistral AI SAS (Paris, France), which serves Mistral models on La Plateforme, hosted in the European Union. Their roles, certifications and data processing agreements are listed in the Security Policy, section "Sub-Processors and Service Providers", and in the Data Processing Agreement; the AI Usage Policy describes the AI providers and those a customer may configure instead. This list is updated before any other processor is engaged.
2. Categories of Processors
Processors are engaged for cloud hosting, payment processing and AI inference.
3. Safeguards for International Transfers
Safeguards include Standard Contractual Clauses and compliance with EU adequacy decisions.
4. Processor-Specific Inquiries
For details about specific processors, contact the data protection contact at privacy@revzper.com.
Data Subjects' Rights
1. Summary of Rights
You have the right to access, rectify, erase, restrict processing, port data, and object to processing based on legitimate interests.
Ref: GDPR Art. 15, GDPR Art. 16, GDPR Art. 17, GDPR Art. 18, GDPR Art. 20, GDPR Art. 21
2. Exercising Rights
Submit a written request to the data protection contact at privacy@revzper.com. Include your full name, contact details, and a clear description of the right(s) you wish to exercise.
3. Response Timeline
We will respond to your request within 30 days of receipt. Additional time may be required with explanation.
4. Lodging a Complaint
You may lodge a complaint with the CNIL (French Data Protection Authority) at commission@cnil.fr or via their website.
Data Retention
1. Retention Principles
Personal data is retained no longer than necessary for the purposes for which it was collected.
2. Retention Periods by Category
Detailed retention periods are available in the Data Retention Policy. A summary is provided below:
- Account Data: Retained for the duration of the relationship plus 3-5 years for legal obligations.
- Technical and Usage Data: Retained for a maximum of 2 years after last interaction, unless required for longer periods.
- Financial Data: Retained for the duration of the relationship and 6 years for legal obligations.
- Communication Data: Retained for a maximum of 3 years after resolution of support requests.
- Product-Specific Data: Retention periods outlined in product-specific documentation.
Data Security
1. Security Measures
We implement encryption, access controls, audit logs, incident response plans, regular security audits, data minimization, and secure authentication.
2. Data Protection Impact Assessments
DPIAs are conducted for high-risk processing activities to identify and mitigate risks. Contact the data protection contact for more information.
International Data Transfers
If data is transferred outside the EEA, adequate safeguards such as Standard Contractual Clauses or adequacy decisions are implemented.
Automated Decision-Making and Profiling
We do not use automated decision-making that produces legal or significant effects. Profiling activities are conducted for service optimization and marketing segmentation without legal or significant effects. You may object to profiling based on legitimate interests.
1. Right to Object to Profiling
Contact the data protection contact at privacy@revzper.com to object to profiling based on legitimate interests.
Ref: GDPR Art. 21
Updates to This Policy
This policy may be updated periodically. All updates are published on our website and notified via email or in-app notification. Material changes are communicated at least 30 days prior to implementation.
Governing Law and Jurisdiction
This policy is governed by French law. Disputes are subject to the exclusive jurisdiction of the courts of Paris, France.
Contact Us
For questions or concerns about this policy, contact the data protection contact at privacy@revzper.com or write to revzper SAS at 60 rue François Ier, 75008 Paris, France.
Product Access Points
For product-specific information, see https://euphile.eu/. The products of the platform are Solon, Vauban, Nassau, Leonardo, Atlas, Plutus, Tzu and Richelieu.